stratops.Cyber capabilities as a service
Domain · Cybersecurity steering

A direction, priorities and follow-up, even without a CISO.

We establish your posture, build a realistic roadmap, keep the indicators and prepare the trade-offs your management must make. Your teams keep the decision; we hold the course.

Describe your needAll domains
Situations

You are in the right place if…

  • You have no CISO, and cybersecurity is handled emergency by emergency.
  • Your management asks « where do we stand? » and you have no figures to answer with.
  • Several audits have produced recommendations nobody has prioritised.
  • Your CISO is absorbed by operations and no longer finds time to steer.
  • A text (NIS 2, DORA) makes management responsible for risk management, and it wants to understand what it approves.
Our conviction

Security needs a direction, priorities and follow-up, even without an in-house CISO.

Without steering, cybersecurity becomes a series of projects launched by incidents, audits and client requests. Budgets scatter; the major risks stay open.

We tie each action to a risk, each risk to an owner, and each quarter to a review with management. The decisions remain yours; we give you what you need to make them.

Our approach

From the assessment to the management review.

A short cycle, repeated each quarter, rather than a master plan frozen for three years.

  1. 01Establish the postureInterviews, document review and targeted checks: where you stand, against a framework suited to your size.

    You getA scored posture, domain by domain

  2. 02Prioritise the risksThe scenarios that threaten your activities, their likelihood, their impact and the measures in place.

    You getA risk register shared with management

  3. 03Build the roadmapCosted actions, ordered by risk reduction, each with an owner and a due date.

    You getA twelve-month roadmap

  4. 04ReportIndicators, progress and residual risks presented to management, with the trade-offs to make.

    You getA quarterly management review

What the texts say

What the texts expect of management.

Recent texts no longer leave cybersecurity to technical teams alone: they make it a responsibility of management.

  • DORADORA art. 5(2) · DORA art. 5(4)

    The management body of a financial entity defines, approves, oversees and is responsible for the implementation of the ICT risk management framework; its members keep up the knowledge needed to assess that risk.12

  • NIS 2NIS 2 art. 20(1) · NIS 2 art. 20(2)

    The directive asks Member States to ensure that the management bodies of entities approve the risk-management measures, oversee their implementation, can be held liable and follow training.34

  • ReCyFReCyF v2.5, objectif 2 · ReCyF v2.5, objectif 16

    The ReCyF (working version) sets entities the objective of a governance framework under the responsibility of the chief executive and, for essential entities, of a risk-based approach that lets it accept residual risks.56

  • CNIL guideGuide CNIL sécurité, fiche 1, F01-PE-05

    The CNIL recommends following IT risks with management, through a management review at least once a year.7

The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.

Our engagement

The same topic, at three levels of engagement.

You choose the level; the scope and deliverables are set by contract.

Level 01

Monitor

We keep the posture and indicators up to date, and flag gaps and changing risks.

Deliverables
  • Posture and indicators kept up to date
  • Watch on the threats and texts that concern you
  • Quarterly dashboard
Level 02

Advise

We analyse the risks, propose priorities and prepare the trade-offs, which you make.

Deliverables
  • Annotated risk register
  • Prioritised, costed roadmap
  • Proposed trade-offs for management
Level 03

Drive

We run the roadmap with your teams and providers, without making the changes in your systems.

Deliverables
  • Running the security committee
  • Tracking of actions, due dates and reminders
  • Management review prepared and documented
Accelerators

What we bring from day one.

Posture framework

An assessment grid proportionate to your size, aligned with what texts and clients expect.

Your tracking web app

Risks, actions, indicators and decisions in one tool shared with your teams, exportable at any time.

Management review templates

A short format, readable by a non-specialist executive, that puts the decisions expected up front.

Frequently asked questions

Before we start.

Are you an outsourced CISO?

We bring a CISO’s steering capability, on the agreed scope, without taking your decision-makers’ place. If you hire a CISO, they take over a documented set-up.

Must management get personally involved?

For a financial entity subject to DORA, the management body is responsible for the ICT risk management framework; for a NIS 2 entity, the directive provides that management bodies approve the measures, subject to the French transposition. Either way, we keep its time to the essentials: understand, decide, follow up.13

Against which framework do you assess our posture?

The one you will be asked for: a text that applies to you, your clients’ requirements, or otherwise a recognised framework proportionate to your size. We avoid stacking several.

How long before a first roadmap?

It depends on your size and on existing documentation; we set it at scoping, with the deliverables, before any commitment.

Start with an assessment.

Describe your organisation and what concerns you. We come back to you with a scoping proposal.

Describe your need
Sources

The excerpts quoted.

Exact text, in its original language, from the frameworks extracted from the official text.

Show the 7 excerpts quoted
  1. 1DORA art. 5(2)32022R2554-a5-p2
    The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1). For the purposes of the first subparagraph, the management body shall:
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
    Version
    CELEX 32022R2554 — ELI reg/2022/2554
    Official text
  2. 2DORA art. 5(4)32022R2554-a5-p4
    Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
    Version
    CELEX 32022R2554 — ELI reg/2022/2554
    Official text
  3. 3NIS 2 art. 20(1)32022L2555-a20-p1
    Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article. The application of this paragraph shall be without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials.
    Normative force
    EU law to be transposed (directive): not directly applicable, requires national transposition
    Source
    Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
    Version
    CELEX 32022L2555 — ELI dir/2022/2555
    Official text
  4. 4NIS 2 art. 20(2)32022L2555-a20-p2
    Member States shall ensure that the members of the management bodies of essential and important entities are required to follow training, and shall encourage essential and important entities to offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.
    Normative force
    EU law to be transposed (directive): not directly applicable, requires national transposition
    Source
    Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
    Version
    CELEX 32022L2555 — ELI dir/2022/2555
    Official text
  5. 5ReCyF v2.5, objectif 2recyf:obj-2
    Les entités [importantes et essentielles] définissent un cadre de gouvernance de la sécurité numérique placé sous la responsabilité du dirigeant exécutif. Le cadre de gouvernance de la sécurité numérique consiste en la mise en place, au sein des entités [importantes et essentielles] : 1. D’une organisation ; 2. De rôles et responsabilités en matière de sécurité numérique ; 3. De processus de gestion de la conformité ; 4. D’une politique de sécurité des systèmes d’information et des politiques comprenant au minimum des dispositions en matière d’usage du chiffrement, de contrôle d’accès physique et logique et de revue de l’application des mesures de sécurité mises en œuvre. Les entités [importantes et essentielles] : - réalisent une analyse de leur conformité vis-à-vis des dispositions [pointer vers les dispositions du décret correspondant aux objectifs de sécurité], - identifient les éventuels écarts existants par rapport aux objectifs de sécurité et, - établissent et suivent dans la durée un plan d’action pour corriger chacun de ces écarts dans les meilleurs délais. Ce plan d’action est adapté à la structure de l’entité et à son environnement. La responsabilité de ce plan d’action est déterminée au regard du cadre de gouvernance de la sécurité numérique mis en place. Les entités essentielles établissent ce plan d’action en tenant compte de l’analyse de risques qu’elles sont tenues de réaliser en application de [l’objectif 16]. Ce plan d’action ne préjuge pas de l’appréciation du respect de ses obligations légales et règlementaires lors d’un contrôle par l’ANSSI.
    Normative force
    obligation (decree, resilience bill)
    Source
    ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
    Version
    2.5 du 17/03/2026 (version de travail)
    Status
    Working version: not binding until the transposition is enacted
    Official text
  6. 6ReCyF v2.5, objectif 16recyf:obj-16
    Les entités [essentielles] mettent en œuvre une approche par les risques placée sous la responsabilité du dirigeant exécutif et leur permettant : 1. de prendre connaissance et de suivre l’évolution des risques pesant sur leurs systèmes d’information ; 2. de définir et suivre la mise en œuvre des mesures de sécurité pour maîtriser ces risques ; 3. d’accepter les risques résiduels.
    Normative force
    obligation (decree, resilience bill)
    Source
    ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
    Version
    2.5 du 17/03/2026 (version de travail)
    Status
    Working version: not binding until the transposition is enacted
    Official text
  7. 7Guide CNIL sécurité, fiche 1, F01-PE-05F01-PE-05
    Assurer un suivi avec la direction en termes de gestion de risques informatiques à travers une revue de direction au moins annuelle. Elle doit permettre d’établir une synthèse et de prendre des décisions considérant : l’évolution du contexte, des enjeux et des attentes des parties prenantes (ex. : clients, partenaires, autorités de contrôle) ; le changement des objectifs et missions de l’organisme ; l’évolution de la menace numérique ; l’essor de nouvelles technologies ou solutions de sécurité ; les évolutions des systèmes d’information et des traitements de données ; l’évolution des risques sur la sécurité des données et la vie privée ; l’avancement du plan d’action juridique (ex. : mise en conformité des contrats) et technique (mesures de sécurité) ; les incidents et violations rencontrés, avec leur impact sur l’organisme et les personnes concernées ; les demandes et plaintes reçues et traitées concernant les données personnelles.
    Normative force
    recommendation (soft law)
    Source
    Guide pratique RGPD — Sécurité des données personnelles
    Version
    2024 (mise à jour 2026)
    Official text